• i mix in some html

SELinux Cheat Sheet

1. Checking SELinux Status

• Check if SELinux is enabled:
  
  sestatus

  sestatus

  
  This command shows the current SELinux status and the enforced mode.

• Set SELinux to enforcing mode (actively enforcing policies):
  
  sudo setenforce 1

  sudo setenforce 1

• Set SELinux to permissive mode (logs actions that would have been blocked):
  
  sudo setenforce 0

  sudo setenforce 0

• Disable SELinux (not recommended for secure environments):
  
  • You need to edit

    /etc/selinux/config

    /etc/selinux/config

    and set

    SELINUX=disabled

    SELINUX=disabled

    , then reboot.

• List all SELinux boolean settings:
  
  getsebool -a

  getsebool -a

• **Change a SELinux boolean setting (temporarily):**```bashsudo setsebool httpd_can_network_connect 1```Replace `httpd_can_network_connect` with the boolean you wish to change.
• **Change a SELinux boolean setting (persistently across reboots):**```bashsudo setsebool -P httpd_can_network_connect 1```

1. Managing File Contexts

• View the SELinux context of a file:
  
  ls -Z /path/to/file

  ls -Z /path/to/file

• **Change the SELinux context of a file:**```bashsudo chcon -t httpd_sys_content_t /path/to/file```This is temporary and will revert if the file system is relabeled or if the file is modified.
• **Permanently change the context of a file using semanage:**```bashsudo semanage fcontext -a -t httpd_sys_content_t "/path/to/file"sudo restorecon -v /path/to/file```This makes the change persistent across file modifications and system relabels.

• **Search for SELinux-related logs:**```bashausearch -m avc -ts recent```This command searches for AVC (Access Vector Cache) denials that have occurred recently.
• **Generate and apply a module to allow previously denied actions:**```bashausearch -m avc -ts recent | audit2allow -M mymodulesudo semodule -i mymodule.pp```This creates and installs a custom module named `mymodule` to allow actions that were previously denied, based on recent AVC denials.

• Changing SELinux policies and contexts should be done with caution, as incorrect settings can result in services not functioning correctly.
• Always back up SELinux policies and important configurations before making significant changes.
• Use

  restorecon

  restorecon

  to revert files to their default context if you encounter issues after changing contexts.
• The

  audit2allow

  audit2allow

  tool is powerful but use it judiciously. Automatically allowing all denied actions can weaken your security stance.
  #
  -----------------------------------------
  This cheat sheet provides a starting point for managing SELinux on your system. SELinux is a complex tool, and its effective use requires a good understanding of your system's security needs and how SELinux policies work.